> **Flag final:** `THM{Th4ts_th3_wr0ng_g4m3_t0mmy}` (validado en THM)

## Resumen del ataque

Room: Benign Path: SOC Level 1 — SIEM Tools: Splunk, ANY.RUN

Can you root this machine?

durante um bug bounty eu sempre procuro achar rotas que pode ser sujeita a IDOR, essa eu encontrei um site **rastreio de pedidos** que…

durante programa de bug bounty, encontrei um parâmetro numérico refletido em uma query SQL **sem aspas e sem prepared statement**. Um WAF…

While reviewing internet-exposed assets associated with an authorized bug bounty target, I used Shodan to identify publicly reachable…

Step-by-step TryHackMe Injectics walkthrough: Learn to chain SQLi and SSTI to achieve full RCE, bypass controls, and retrieve all flags.

A WordPress plugin with 20,000 installs disabled the framework’s own file-type validation. The interesting question wasn’t how it worked…

Arista Networks published four security advisories on September 9, 2026, resolving multiple critical security flaws. These critical Arista EOS vulnerabilities allow unauthenticated attackers to ex…

Security researchers discovered a critical Secure Boot bypass vulnerability impacting multiple major hardware vendors today. This flaw exists within the Unified Extensible Firmware Interface (UEFI…

TL;DR MongoDB fixed 24 MongoDB Server vulnerabilities in recent releases. One critical flaw can leave authorization disabled at startup. Most others cause denial of service, and no in-the-wild exp…

Okta published security advisories resolving six vulnerabilities across several enterprise identity products on September 9, 2026. These critical Okta vulnerabilities impact the Auth0 AD/LDAP Conn…

Researchers recently published the LSPromise exploit chain, demonstrating a complete path from a local untrusted app to full kernel control. This severe flaw impacts devices running the initial An…

If you’ve ever wanted to teach LLM security but struggled to find a realistic, hands-on lab that actually works, meet yoloLLM — an…

By Dr. Delminquoe L. Cunningham

Beginner-friendly walkthrough covering clients, servers, ports, DNS, and HTTP basics..

What a full-scope penetration testing assessment taught me about web application security, Windows, Linux, and Active Directory

NVIDIA patched two high-severity security flaws in its AI inferencing platform on September 10, 2026. These critical Triton Inference Server vulnerabilities allow unauthenticated remote attackers …